0597483486ad2692fc49e5ec386e557f15ba9ca41e1be19214130a47fc6faf87

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pacܵ绰г/lib/driverfile/spc/installex.bat
Size 140B
Sample260506-gzmegaft6j
SHA256 0597483486ad2692fc49e5ec386e557f15ba9ca41e1be19214130a47fc6faf87
MD5 08452c90d65fd3791f99c07550b09196
SHA1 09f1e90f70243cb297b46e17e2f795a1e0f6e981
SHA512 d184a13f36a6a118388a709c9d502e15d380edeb08261368b01306f39eef6d21544f57cf096557092f152824d71528d3dd7d83835bbec988982c6f2ecec83b77
TLSH
T1A4C02B4145374FB0C347CCFA1100700C000ECE0F22B2C1C9D0260071786464EC533030
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3168	bcdedit.exe
2592	bcdedit.exe

Enables test signing to bypass driver trust controls 1 TTPs 1 IoCs

Allows any signed driver to load without validation against a trusted certificate authority.

defense_evasion

Code Signing Policy Modification

T1553.006

pid	Process
2592	bcdedit.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3432	3496	cmd.exe	81
PID 3496 wrote to memory of 3168	3496	cmd.exe	82
PID 3496 wrote to memory of 2592	3496	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pacܵ绰г\lib\driverfile\spc\installex.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\Pacܵ绰г\lib\driverfile\spc\certmgr.exe
  CertMgr -add icc301root.cer -s -r localMachine root
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3432
- C:\Users\Admin\AppData\Local\Temp\Pacܵ绰г\lib\driverfile\spc\bcdedit.exe
  bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\Pacܵ绰г\lib\driverfile\spc\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  - Enables test signing to bypass driver trust controls
  PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Code Signing Policy Modification

T1553.006

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads